o
    sDie0                     @  s  d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
mZmZmZmZmZ ddlZddlmZ ddlmZ ddlmZmZmZmZmZmZmZmZmZ dd	lm Z m!Z! dd
l"m#Z# ddl$m%Z%m&Z& e
rvddl'm(Z( ddl)m*Z* dZ+dddZ,eG dd dZ-d ddZ.dS )!z$MONGODB-OIDC Authentication helpers.    )annotationsN)	dataclassfield)TYPE_CHECKINGAnyMappingMutableMappingOptionalUnion)Binary)	remaining)	CALLBACK_VERSIONHUMAN_CALLBACK_TIMEOUT_SECONDS MACHINE_CALLBACK_TIMEOUT_SECONDSTIME_BETWEEN_CALLS_SECONDSOIDCCallbackOIDCCallbackContextOIDCCallbackResultOIDCIdPInfo_OIDCProperties)ConfigurationErrorOperationFailure)_AUTHENTICATION_FAILURE_CODE)Lock_async_create_lock)AsyncConnection)MongoCredentialFcredentialsr   addresstuple[str, int]return_OIDCAuthenticatorc                 C  s   | j jr| j jS | j}| j}|jd urFd}|j}|D ]}||d kr%d}q|dr7|d |dd  r7d}q|sFtd|d  d| t	||d| j _| j jS )	NFr   Tz*.   zRefusing to connect to z(, which is not in authOIDCAllowedHosts: )username
properties)
cachedatar#   mechanism_propertieshuman_callbackallowed_hosts
startswithendswithr   r!   )r   r   principal_namer$   foundr)   patt r/   \/home/alumno/antzosa8961/venv/lib/python3.10/site-packages/pymongo/asynchronous/auth_oidc.py_get_authenticator1   s&   
 r1   c                   @  s$  e Zd ZU ded< ded< eddZded< eddZded	< eddZd
ed< eddZded< e	s=ee
dZded< n	ee
dZded< eddZded< d=ddZd=ddZd>ddZd?d!d"Zd=d#d$Zd@d%d&ZdAd)d*ZdBd.d/ZdCd1d2ZdDd4d5Zd?d6d7ZdEd9d:ZdFd;d<ZdS )Gr!   strr#   r   r$   N)defaultOptional[str]refresh_tokenaccess_tokenzOptional[OIDCIdPInfo]idp_infor   inttoken_gen_id)default_factoryr   lockzthreading.Lockfloatlast_call_timeconnr   r    Optional[Mapping[str, Any]]c                   s4   |  | | jjr| |I dH S | |I dH S )z(Handle a reauthenticate from the server.N)_invalidater$   callback_authenticate_machine_authenticate_human)selfr>   r/   r/   r0   reauthenticate]   s
   
z!_OIDCAuthenticator.reauthenticatec                   sZ   |j }|r| r|j}|r|d r| j|_|S | jjr%| |I dH S | |I dH S )z'Handle an initial authenticate request.doneN)	auth_ctxspeculate_succeededspeculative_authenticater9   oidc_token_gen_idr$   rA   rB   rC   )rD   r>   ctxrespr/   r/   r0   authenticatef   s   z_OIDCAuthenticator.authenticate"Optional[MutableMapping[str, Any]]c                 C  s   | j sdS | d| j iS )z-Get the appropriate speculative auth command.Njwt)r6   _get_start_command)rD   r/   r/   r0   get_spec_auth_cmdx   s   z$_OIDCAuthenticator.get_spec_auth_cmdMapping[str, Any]c              
     sl   | j r.z	| |I d H W S  ty- } z| |r(| |I d H W  Y d }~S  d }~ww | |I d H S N)r6   _sasl_start_jwtr   _is_auth_errorrB   )rD   r>   er/   r/   r0   rB   ~   s   
z(_OIDCAuthenticator._authenticate_machinec              
     s   | j r.z	| |I d H W S  ty- } z| |r(| |I d H W  Y d }~S  d }~ww | jr^z	| |I d H W S  ty] } z| |rXd | _| |I d H W  Y d }~S  d }~ww | d }| ||I d H }| ||I d H S rS   )	r6   rT   r   rU   rC   r5   rP   _run_command_sasl_continue_jwt)rD   r>   rV   cmd
start_respr/   r/   r0   rC      s.   
	

z&_OIDCAuthenticator._authenticate_humanc           
   	     s  | j }|jd u}|r| jd u rd S |jr|j}|jr|j}| j}|r%|S |d u r-|s-d S |s|d ur| j4 I d H  | j}||krN|W  d   I d H  S t | j }|tk rct	
t| I d H  t | _|rtt}| jd ussJ ntt pyt}t|t| j| j| j jd}tst	 d |j|I d H }	n||}	t|	tstdt|	 |	j| _|	j| _|  jd7  _W d   I d H  | jS 1 I d H sw   Y  | jS )N)timeout_secondsversionr5   r7   r#   z8Callback result must be of type OIDCCallbackResult, not r"   )r$   r(   r7   rA   r6   r;   timer=   r   asynciosleepr   r8   r   r   r   r   r5   r#   _IS_SYNCget_running_looprun_in_executorfetch
isinstancer   
ValueErrortyper9   )
rD   r$   is_humancb
prev_token	new_tokendeltatimeoutcontextrL   r/   r/   r0   _get_access_token   sb   



%%z$_OIDCAuthenticator._get_access_tokenrY   MutableMapping[str, Any]c              
     sJ   z|j d|ddI d H W S  ty$ } z| |r| |  d }~ww )Nz	$externalT)	no_reauth)commandr   rU   r@   )rD   r>   rY   rV   r/   r/   r0   rW      s   

z_OIDCAuthenticator._run_commanderr	Exceptionboolc                 C  s   t |tsdS |jtkS )NF)rd   r   coder   )rD   rr   r/   r/   r0   rU      s   

z!_OIDCAuthenticator._is_auth_errorNonec                 C  s*   |j pd}|d ur|| jk rd S d | _d S )Nr   )rJ   r9   r6   )rD   r>   r9   r/   r/   r0   r@      s   

z_OIDCAuthenticator._invalidaterZ   c                   sl   d | _ d | _t|d }d|v rtdi || _|  I d H }| j|_| 	d|i|}| 
||I d H S )NpayloadissuerrO   r/   )r6   r5   bsondecoder   r7   rn   r9   rJ   _get_continue_commandrW   )rD   r>   rZ   start_payloadr6   rY   r/   r/   r0   rX     s   z%_OIDCAuthenticator._sasl_continue_jwtc                   s8   |   I d H }| j|_| d|i}| ||I d H S )NrO   )rn   r9   rJ   rP   rW   )rD   r>   r6   rY   r/   r/   r0   rT     s
   z"_OIDCAuthenticator._sasl_start_jwtrw   c                 C  s:   |d u r| j }|rd|i}ni }tt|}dd|dS )Nnr"   zMONGODB-OIDC)	saslStart	mechanismrw   )r#   r   ry   encode)rD   rw   r,   bin_payloadr/   r/   r0   rP     s   
z%_OIDCAuthenticator._get_start_commandc                 C  s   t t|}d||d dS )Nr"   conversationId)saslContinuerw   r   )r   ry   r   )rD   rw   rZ   r   r/   r/   r0   r{     s
   z(_OIDCAuthenticator._get_continue_command)r>   r   r    r?   )r    rN   )r>   r   r    rR   )r    r4   )r>   r   rY   ro   r    rR   )rr   rs   r    rt   )r>   r   r    rv   )r>   r   rZ   rR   r    rR   )rw   r?   r    ro   )rw   rR   rZ   rR   r    ro   )__name__
__module____qualname____annotations__r   r5   r6   r7   r9   r`   r   r;   r=   rE   rM   rQ   rB   rC   rn   rW   rU   r@   rX   rT   rP   r{   r/   r/   r/   r0   r!   N   s0   
 

	



!
=






r>   r   rE   rt   r?   c                   s2   t | |j}|r||I dH S ||I dH S )z Authenticate using MONGODB-OIDC.N)r1   r   rE   rM   )r   r>   rE   authenticatorr/   r/   r0   _authenticate_oidc)  s
   r   )r   r   r   r   r    r!   )r   r   r>   r   rE   rt   r    r?   )/__doc__
__future__r   r^   	threadingr]   dataclassesr   r   typingr   r   r   r   r	   r
   ry   bson.binaryr   pymongo._csotr   pymongo.auth_oidc_sharedr   r   r   r   r   r   r   r   r   pymongo.errorsr   r   pymongo.helpers_sharedr   pymongo.lockr   r   pymongo.asynchronous.poolr   pymongo.auth_sharedr   r`   r1   r!   r   r/   r/   r/   r0   <module>   s.    ,
 [